{"thread":{"id":"61639","subject":"Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","startedAt":"2024-06-17T00:37:02Z","lastAt":"2024-09-25T11:34:25Z","messageCount":20,"participants":["David C. Rankin","Junio C Hamano","Michal Suchánek","Phillip Wood","Jamie Landeg-Jones","Joey Hess"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"497229","messageId":"d9a83e5b-5075-47c6-85c8-e0b550cf859b@gmail.com","threadId":"61639","inReplyTo":null,"subject":"Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"David C. Rankin","fromEmail":"drankinatty@gmail.com","sentAt":"2024-06-17T00:36:59Z","receivedAt":"2024-06-17T00:37:02Z","isPatch":false,"sender":{"key":"drankinatty@gmail.com","avatar":null},"body":"All,\n\n   Security enhancement in 2.45.1 have broken ability to serve git over https \nand ssh from local git server running Apache. (web server runs as http:http on \nArchlinux)\n\n   The fix of adding the following to gitconfig (system-wide and per-user in \n~/.gitconfig) does not solve the problem:\n\n[safe]\n\tdirectory = *\n\n(* or the actual /srv/git/reponame.git makes no difference)\n\n   On Archlinux, all repos are served from /srv/git. This has worked well for \nboth https and ssh allowing repos under /srv/git to be owned by the user with \npublic-private ssh key. (they are members of group owning /srv/git with write \nprivileges)\n\n   After 2.45.1,\n\n   - git will not allow https unless the repositories are OWNED by http.\n   - git will not allow ssh   unless the repositories are OWNED by user.\n\n   A catch-22.\n\n   I've tried every possible file repository ownership of http:user and \nuser:http with permissions of 0775, but no luck, it is either one or the \nother. I've even tried making users members of the http group, but ssh still \nrefuses push unless the repository is OWNED by user.\n\n   The errors run the gamut from https attmepts:\n\n$ git pull\nfatal: unable to access 'https://www.mydomain.com/git/examples.git/': The \nrequested URL returned error: 500\n\nto ssh attempts:\n\n$ git push\nEnumerating objects: 7, done.\nCounting objects: 100% (7/7), done.\nDelta compression using up to 4 threads\nCompressing objects: 100% (4/4), done.\nWriting objects: 100% (5/5), 1.01 KiB | 1.01 MiB/s, done.\nTotal 5 (delta 2), reused 0 (delta 0), pack-reused 0\nremote: error: cannot lock ref 'HEAD': Unable to create \n'/srv/git/pico.git/./HEAD.lock': Permission denied\nTo valkyrie:/srv/git/pico.git\n  ! [remote rejected] master -> master (failed to update ref)\nerror: failed to push some refs to 'valkyrie:/srv/git/pico.git'\n\n   This was discussed on the arch-general mailing list under the thread \"git \nserver changes - how to allow https AND ssh now that /srv/git/xxx.git must be \nowned by http?\" at \nhttps://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/thread/3GCCU6QZNGRY45WMQAQEVF572AIHN646/\n\n   There was a suggestion to try a bind mount for the repositories, but that \nseems like it may introduce other issues, but if that is the correct approach \nI'm happy to try it.\n\n   What is the correct local-server way to now serve repositories over https \nAND ssh from Apache without running into this either-or ownership problem?\n\n(gitweb continues to work fine)\n\n-- \nDavid C. Rankin, J.D.,P.E.\n"},{"id":"497251","messageId":"xmqq8qz376fb.fsf@gitster.g","threadId":"61639","inReplyTo":"d9a83e5b-5075-47c6-85c8-e0b550cf859b@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-06-17T18:47:20Z","receivedAt":"2024-06-17T18:47:33Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"David C. Rankin\" <drankinatty@gmail.com> writes:\n\n>   Security enhancement in 2.45.1 have broken ability to serve git over\n>   https and ssh from local git server running Apache. (web server runs\n>   as http:http on Archlinux)\n>\n>   The fix of adding the following to gitconfig (system-wide and\n>   per-user in ~/.gitconfig) does not solve the problem:\n>\n> [safe]\n> \tdirectory = *\n\nIt is not clear what you exactly meant \"per-user\" above, so just to\nmake sure.  Is this set in the global configuration file for the\nhttpd (or whoever Apache runs as) user?\n\nThe purpose of \"dubious ownershop\" thing is to protect the user who\nruns Git from random repositories' with potentially malicious hooks\nand configuration files, so the user being protected (in this case,\nwhoever Apache runs as) needs to declare \"I trust these\nrepositories\" in its ~/.gitconfig file.  What individual owners of\n/srv/my-repo.git/ project has in their ~/.gitconfig file does not\nmatter when deciding if Apache trusts these repositories.\n\n\n"},{"id":"497262","messageId":"20240617211513.GM19642@kitsune.suse.cz","threadId":"61639","inReplyTo":"xmqq8qz376fb.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Michal Suchánek","fromEmail":"msuchanek@suse.de","sentAt":"2024-06-17T21:15:13Z","receivedAt":"2024-06-17T21:15:16Z","isPatch":false,"sender":{"key":"msuchanek@suse.de","avatar":"https://avatars.githubusercontent.com/u/787652?v=4"},"body":"Hello,\n\nOn Mon, Jun 17, 2024 at 11:47:20AM -0700, Junio C Hamano wrote:\n> \"David C. Rankin\" <drankinatty@gmail.com> writes:\n> \n> >   Security enhancement in 2.45.1 have broken ability to serve git over\n> >   https and ssh from local git server running Apache. (web server runs\n> >   as http:http on Archlinux)\n> >\n> >   The fix of adding the following to gitconfig (system-wide and\n> >   per-user in ~/.gitconfig) does not solve the problem:\n> >\n> > [safe]\n> > \tdirectory = *\n> \n> It is not clear what you exactly meant \"per-user\" above, so just to\n> make sure.  Is this set in the global configuration file for the\n> httpd (or whoever Apache runs as) user?\n> \n> The purpose of \"dubious ownershop\" thing is to protect the user who\n> runs Git from random repositories' with potentially malicious hooks\n> and configuration files, so the user being protected (in this case,\n> whoever Apache runs as) needs to declare \"I trust these\n> repositories\" in its ~/.gitconfig file.  What individual owners of\n> /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n> matter when deciding if Apache trusts these repositories.\n\n\nlooks like the semantic of 'dubious ownershop' changed recently.\n\nDisro backport of fixes for CVE-2024-32002 CVE-2024-32004 CVE-2024-32020\nCVE-2024-32021 CVE-2024-32465 to 2.35.3 broke git-daemon. No amount of\nwhitelisting makes the 'fixed' git serve the repository.\n\nOf course, this might be bug in the backpotrt as much as but in the\nupstream logic, not analyzed yet.\n\nHowever, serving repositories is a gaping security hole right now. At\nleast on some 'stable' distributions.\n\nThanks\n\nMichal\n"},{"id":"497266","messageId":"d5ff3629-ef8c-472b-886a-3ec0dd6a2c9a@gmail.com","threadId":"61639","inReplyTo":"xmqq8qz376fb.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"David C. Rankin","fromEmail":"drankinatty@gmail.com","sentAt":"2024-06-18T01:08:07Z","receivedAt":"2024-06-18T01:08:11Z","isPatch":false,"sender":{"key":"drankinatty@gmail.com","avatar":null},"body":"On 6/17/24 13:47, Junio C Hamano wrote:\n> \"David C. Rankin\" <drankinatty@gmail.com> writes:\n> \n>>    Security enhancement in 2.45.1 have broken ability to serve git over\n>>    https and ssh from local git server running Apache. (web server runs\n>>    as http:http on Archlinux)\n>>\n>>    The fix of adding the following to gitconfig (system-wide and\n>>    per-user in ~/.gitconfig) does not solve the problem:\n>>\n>> [safe]\n>> \tdirectory = *\n> \n> It is not clear what you exactly meant \"per-user\" above, so just to\n> make sure.  Is this set in the global configuration file for the\n> httpd (or whoever Apache runs as) user?\n> \n> The purpose of \"dubious ownershop\" thing is to protect the user who\n> runs Git from random repositories' with potentially malicious hooks\n> and configuration files, so the user being protected (in this case,\n> whoever Apache runs as) needs to declare \"I trust these\n> repositories\" in its ~/.gitconfig file.  What individual owners of\n> /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n> matter when deciding if Apache trusts these repositories.\n> \n> \n\n   I apologize for being unclear. The directory on the server (valkyrie) that \nhosts the repositories has the current ownerships:\n\n19:53 valkyrie:/srv/git> l\ntotal 60\ndrwxr-xr-x 15 http  http  4096 Feb 13 02:37 .\ndrwxr-xr-x  6 root  root  4096 Jan  4  2017 ..\ndrwxr-xr-x  7 http  david 4096 Feb  1 06:54 arm.git\ndrwxr-xr-x  7 david david 4096 Nov 13  2023 c_datastructs.git\ndrwxr-xr-x  7 david david 4096 Jun 15 02:42 embedded.git\ndrwxr-xr-x  7 http  http  4096 Jan 26 01:34 examples.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 gtkedit.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 gtkeditphmirror.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 gtkwritemirror.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 mtrxsolv.git\ndrwxr-xr-x  7 http  devs  4096 Aug 13  2023 notesdlg.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 objstate.git\ndrwxr-xr-x  7 http  devs  4096 Nov 13  2023 pgauth.git\ndrwxr-xr-x  7 david david 4096 Jun 16 19:14 pico.git\ndrwxr-xr-x  7 http  david 4096 Aug 13  2023 vect_t.git\n\n   Prior to this dubious ownership issue, everything was owned by david:david, \nother than notesdg.git and pgauth.git which were david:devs with other \ndevelopers made members of the devs group.\n\n   After 2.45.1 update, those with read-only access over https could not pull \nupdates anymore. I didn't notice right away because I pull everything over ssh.\n\n   I do have other machines where I pull https copies of repos, and that too \nbroke after 2.45.1.\n\n   I read the error from the server log and then attempted to add the \nsuggested config to ~/.gitconfig, e.g.:\n\n[safe]\n\tdirectory = /srv/git/embedded.git\n\n   That failed. I then scoured the internet and many posts said use * for all \ninstead of individual directory names, e.g.\n\n[safe]\n\tdirectory = *\n\n   Same error.\n\n   I then changed ownership over everything in /srv/git to http:http and https \nstarted working again! But ... when I tried to push over ssh it failed, e.g.\n\n19:14 wizard:~/dev/arm/pico> git push\nEnumerating objects: 7, done.\nCounting objects: 100% (7/7), done.\nDelta compression using up to 4 threads\nCompressing objects: 100% (4/4), done.\nWriting objects: 100% (5/5), 1.01 KiB | 1.01 MiB/s, done.\nTotal 5 (delta 2), reused 0 (delta 0), pack-reused 0\nremote: error: cannot lock ref 'HEAD': Unable to create \n'/srv/git/pico.git/./HEAD.lock': Permission denied\nTo valkyrie:/srv/git/pico.git\n  ! [remote rejected] master -> master (failed to update ref)\nerror: failed to push some refs to 'valkyrie:/srv/git/pico.git'\n\n   I have tried every combination of ownership, e.g. david:david, david:http, \nhttp:david and the bottom line is:\n\n   - https won't work unless http owns the repository (http:dontcare), and\n   - ssh won't work unless the user owns the repository (david:dontcare)\n\n   Somehow I need a configuration that allows both ssh and https to work \ntogether. My apache config is setup per the scm-git.com book adapted to use my \nserver auth:\n\n## git directory for https access\n\nSetEnv GIT_PROJECT_ROOT /srv/git\nScriptAlias /git/ /usr/lib/git-core/git-http-backend/\nScriptAlias /git /usr/lib/git-core/git-http-backend/\n\n<Directory /usr/lib/git-core>\n   Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch\n   AllowOverride None\n   Require all granted\n</Directory>\n\n<Files \"git-http-backend\">\n   # authentication\n   AuthType Basic\n   AuthName \"Skyline_Restricted\"\n   AuthBasicProvider dbm\n   AuthDBMType DB\n   AuthDBMUserFile /usr/local/lib/apache2/dcraccess\n   Require expr !(%{QUERY_STRING} -strmatch '*service=git-receive-pack*' || \n%{REQUEST_URI} =~ m#/git-receive-pack$#)\n   Require valid-user\n</Files>\n\n   This has always worked great. It's just the side effect of the latest \ndubious ownership security changes that have killed it.\n\n   Hopefully this is just a temporary regression in the CVE fixes? Let me know \nif you need any more information. I'm happy to provide it.\n\n\n-- \nDavid C. Rankin, J.D.,P.E.\n\n"},{"id":"497570","messageId":"xmqqo77qgznt.fsf@gitster.g","threadId":"61639","inReplyTo":"d5ff3629-ef8c-472b-886a-3ec0dd6a2c9a@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-06-24T14:53:42Z","receivedAt":"2024-06-24T14:53:50Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"David C. Rankin\" <drankinatty@gmail.com> writes:\n\n>   I read the error from the server log and then attempted to add the\n>   suggested config to ~/.gitconfig, e.g.:\n>\n> [safe]\n> \tdirectory = /srv/git/embedded.git\n> ...\n> drwxr-xr-x  7 david david 4096 Jun 15 02:42 embedded.git\n\nYou say ~/.gitconfig here.  Whose home directory does \"~\" refer to?\n\nThe primary reason I wrote the message you are responding to was to\nfind this piece of information out (and tell you that it would be\ndifferent from the repository owner's), and I am still not sure if I\nextracted that piece of information out of you, after reading the\nmessage I am responding to twice.\n\nIn short, the above has to be in ~http/.gitconfig (if 'http' is the\nuser Apache runs as).  Listing it in ~david/.gitconfig would not\nwork.  It has to come from the user who runs Git in a directory the\nuser does not own (in this case, that is the 'http' user.  That user\nruns, via the CGI interface, the server side Git programs to respond\nto pushes and fetches, serving a repository not owned by 'http'),\n\nThe mechanism is about protecting the user that runs Git (i.e.\n'http' in the context of \"git push/fetch is responded by the Apache\nweb server via the CGI mechanism spawning 'git http-backend'\") from\npotentially malicious repositories owned by users that are *not*\n'http' (i.e. /srv/git/embedded.git that is owned by david:david in\nthis case), as such repositories can contain hooks and other\nconfiguration settings that would end up running programs as 'http'\nuser with 'http' user's priviledge, potentially writing into files\nowned by 'http' user to attack 'http' user.\n\nHence, the \"I am OK to run Git as myself in these repositories, even\nthough they are not owned by me\" acceptance, which is an snippet in\ngitconfig file you showed above, has to come from the 'http' user,\nand certainly not from the 'david' user.  The configuration is about\nprotecting 'http' from 'david' and not about protecting 'david' from\n'http', so configuration files in 'david' user's home directory\nshould have no say in who 'http' user is willing to trust.\n\nSo, back to the original question.  You said ~/.gitconfig/ has the\nsafe.directory settings.  Whose ~/.gitconfig/?\n\nI would have expected that the only thing you'd need to do is to let\nyour 'http' user tell Git that it does not want the paranoid safety\nmore recent versions of Git offers with the safe.directory setting\nin ~http/.gitconfig, and have repositories owned by individual users\nthat come over ssh as they themselves.  For those who are accessing\ntheir own repositories over ssh as themselves, everything should\nwork just as before.\n"},{"id":"497606","messageId":"20240625072419.GU19642@kitsune.suse.cz","threadId":"61639","inReplyTo":"20240617211513.GM19642@kitsune.suse.cz","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Michal Suchánek","fromEmail":"msuchanek@suse.de","sentAt":"2024-06-25T07:24:19Z","receivedAt":"2024-06-25T07:24:23Z","isPatch":false,"sender":{"key":"msuchanek@suse.de","avatar":"https://avatars.githubusercontent.com/u/787652?v=4"},"body":"On Mon, Jun 17, 2024 at 11:15:13PM +0200, Michal Suchánek wrote:\n> Hello,\n> \n> On Mon, Jun 17, 2024 at 11:47:20AM -0700, Junio C Hamano wrote:\n> > \"David C. Rankin\" <drankinatty@gmail.com> writes:\n> > \n> > >   Security enhancement in 2.45.1 have broken ability to serve git over\n> > >   https and ssh from local git server running Apache. (web server runs\n> > >   as http:http on Archlinux)\n> > >\n> > >   The fix of adding the following to gitconfig (system-wide and\n> > >   per-user in ~/.gitconfig) does not solve the problem:\n> > >\n> > > [safe]\n> > > \tdirectory = *\n> > \n> > It is not clear what you exactly meant \"per-user\" above, so just to\n> > make sure.  Is this set in the global configuration file for the\n> > httpd (or whoever Apache runs as) user?\n> > \n> > The purpose of \"dubious ownershop\" thing is to protect the user who\n> > runs Git from random repositories' with potentially malicious hooks\n> > and configuration files, so the user being protected (in this case,\n> > whoever Apache runs as) needs to declare \"I trust these\n> > repositories\" in its ~/.gitconfig file.  What individual owners of\n> > /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n> > matter when deciding if Apache trusts these repositories.\n> \n> \n> looks like the semantic of 'dubious ownershop' changed recently.\n> \n> Disro backport of fixes for CVE-2024-32002 CVE-2024-32004 CVE-2024-32020\n> CVE-2024-32021 CVE-2024-32465 to 2.35.3 broke git-daemon. No amount of\n> whitelisting makes the 'fixed' git serve the repository.\n\nSame regression between 2.45.0 and 2.45.2 which allegedly fixes the\nsame CVEs.\n\nLooks like downgrading to gaping hole version is needed to serve repositories\nin general.\n\nPlease consider adjusting the fix so that repositories can still be served.\n\nThanks\n\nMichal\n\nTo reproduce:\n\ncat /usr/local/bin/git-ping\n#!/bin/sh -e\n\n# Try connecting to one or more remote repository URLs\n\nwhile true ; do\n        git ls-remote -h \"$1\" >/dev/null\n        shift\n        [ -n \"$1\" ] || break\ndone\n\nmkdir -p /srv/git/some\nchown hramrach /srv/git/some\nsu hramrach -c \"git init --bare /srv/git/some/repo.git\"\nsu hramrach -c \"touch /srv/git/some/repo.git/git-daemon-export-ok\"\nversion=2.35.3-150300.10.36.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\nsystemctl start git-daemon.service\ngit ping git://localhost/some/repo.git\n<nothing>\n\nversion=2.35.3-150300.10.39.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\nsystemctl restart git-daemon.service\ngit ping git://localhost/some/repo.git\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n\n\nsystemctl status git-daemon.service\n● git-daemon.service - Git Daemon\n     Loaded: loaded (/usr/lib/systemd/system/git-daemon.service; disabled; vendor preset: disabled)\n     Active: active (running) since Thu 2024-06-06 08:29:28 CEST; 6min ago\n   Main PID: 31742 (git)\n      Tasks: 2 (limit: 4915)\n     CGroup: /system.slice/git-daemon.service\n             ├─ 31742 git daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n             └─ 31749 /usr/lib/git/git-daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n\nJun 06 08:29:28 localhost.localdomain systemd[1]: Started Git Daemon.\nJun 06 08:29:39 localhost.localdomain git-daemon[31756]: fatal: detected dubious ownership in repository at '/srv/git//some/repo.git'\nJun 06 08:29:39 localhost.localdomain git-daemon[31756]: To add an exception for this directory, call:\nJun 06 08:29:39 localhost.localdomain git-daemon[31756]:         git config --global --add safe.directory /srv/git//some/repo.git\n\ngit config --global --add safe.directory /srv/git//some/repo.git\nmv ~/.gitconfig /etc/gitconfig\ngit ping git://localhost/some/repo.git\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n\ngit config --global --add safe.directory /srv/git/some/repo.git\nmv ~/.gitconfig /etc/gitconfig\ngit ping git://localhost/some/repo.git\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n"},{"id":"497626","messageId":"xmqqr0cl6lxl.fsf@gitster.g","threadId":"61639","inReplyTo":"20240625072419.GU19642@kitsune.suse.cz","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-06-25T16:12:38Z","receivedAt":"2024-06-25T16:12:49Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Dscho, the f4aa8c8b (fetch/clone: detect dubious ownership of local\nrepositories, 2024-04-10) is your brainchild and people seem to be\nunhappy about having to adjust their settings.  Are there any advice\nyou can offer them?\n\nMichal Suchánek <msuchanek@suse.de> writes:\n\n> On Mon, Jun 17, 2024 at 11:15:13PM +0200, Michal Suchánek wrote:\n>> Hello,\n>> \n>> On Mon, Jun 17, 2024 at 11:47:20AM -0700, Junio C Hamano wrote:\n>> > \"David C. Rankin\" <drankinatty@gmail.com> writes:\n>> > \n>> > >   Security enhancement in 2.45.1 have broken ability to serve git over\n>> > >   https and ssh from local git server running Apache. (web server runs\n>> > >   as http:http on Archlinux)\n>> > >\n>> > >   The fix of adding the following to gitconfig (system-wide and\n>> > >   per-user in ~/.gitconfig) does not solve the problem:\n>> > >\n>> > > [safe]\n>> > > \tdirectory = *\n>> > \n>> > It is not clear what you exactly meant \"per-user\" above, so just to\n>> > make sure.  Is this set in the global configuration file for the\n>> > httpd (or whoever Apache runs as) user?\n>> > \n>> > The purpose of \"dubious ownershop\" thing is to protect the user who\n>> > runs Git from random repositories' with potentially malicious hooks\n>> > and configuration files, so the user being protected (in this case,\n>> > whoever Apache runs as) needs to declare \"I trust these\n>> > repositories\" in its ~/.gitconfig file.  What individual owners of\n>> > /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n>> > matter when deciding if Apache trusts these repositories.\n>> \n>> \n>> looks like the semantic of 'dubious ownershop' changed recently.\n>> \n>> Disro backport of fixes for CVE-2024-32002 CVE-2024-32004 CVE-2024-32020\n>> CVE-2024-32021 CVE-2024-32465 to 2.35.3 broke git-daemon. No amount of\n>> whitelisting makes the 'fixed' git serve the repository.\n>\n> Same regression between 2.45.0 and 2.45.2 which allegedly fixes the\n> same CVEs.\n>\n> Looks like downgrading to gaping hole version is needed to serve repositories\n> in general.\n>\n> Please consider adjusting the fix so that repositories can still be served.\n>\n> Thanks\n>\n> Michal\n>\n> To reproduce:\n>\n> cat /usr/local/bin/git-ping\n> #!/bin/sh -e\n>\n> # Try connecting to one or more remote repository URLs\n>\n> while true ; do\n>         git ls-remote -h \"$1\" >/dev/null\n>         shift\n>         [ -n \"$1\" ] || break\n> done\n>\n> mkdir -p /srv/git/some\n> chown hramrach /srv/git/some\n> su hramrach -c \"git init --bare /srv/git/some/repo.git\"\n> su hramrach -c \"touch /srv/git/some/repo.git/git-daemon-export-ok\"\n> version=2.35.3-150300.10.36.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n> systemctl start git-daemon.service\n> git ping git://localhost/some/repo.git\n> <nothing>\n>\n> version=2.35.3-150300.10.39.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n> systemctl restart git-daemon.service\n> git ping git://localhost/some/repo.git\n> fatal: Could not read from remote repository.\n>\n> Please make sure you have the correct access rights\n> and the repository exists.\n>\n>\n> systemctl status git-daemon.service\n> ● git-daemon.service - Git Daemon\n>      Loaded: loaded (/usr/lib/systemd/system/git-daemon.service; disabled; vendor preset: disabled)\n>      Active: active (running) since Thu 2024-06-06 08:29:28 CEST; 6min ago\n>    Main PID: 31742 (git)\n>       Tasks: 2 (limit: 4915)\n>      CGroup: /system.slice/git-daemon.service\n>              ├─ 31742 git daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n>              └─ 31749 /usr/lib/git/git-daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n>\n> Jun 06 08:29:28 localhost.localdomain systemd[1]: Started Git Daemon.\n> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: fatal: detected dubious ownership in repository at '/srv/git//some/repo.git'\n> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: To add an exception for this directory, call:\n> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]:         git config --global --add safe.directory /srv/git//some/repo.git\n>\n> git config --global --add safe.directory /srv/git//some/repo.git\n> mv ~/.gitconfig /etc/gitconfig\n> git ping git://localhost/some/repo.git\n> fatal: Could not read from remote repository.\n>\n> Please make sure you have the correct access rights\n> and the repository exists.\n>\n> git config --global --add safe.directory /srv/git/some/repo.git\n> mv ~/.gitconfig /etc/gitconfig\n> git ping git://localhost/some/repo.git\n> fatal: Could not read from remote repository.\n>\n> Please make sure you have the correct access rights\n> and the repository exists.\n"},{"id":"497655","messageId":"20240625183411.GW19642@kitsune.suse.cz","threadId":"61639","inReplyTo":"xmqqr0cl6lxl.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Michal Suchánek","fromEmail":"msuchanek@suse.de","sentAt":"2024-06-25T18:34:11Z","receivedAt":"2024-06-25T18:34:14Z","isPatch":false,"sender":{"key":"msuchanek@suse.de","avatar":"https://avatars.githubusercontent.com/u/787652?v=4"},"body":"Hello,\n\nOn Tue, Jun 25, 2024 at 09:12:38AM -0700, Junio C Hamano wrote:\n> Dscho, the f4aa8c8b (fetch/clone: detect dubious ownership of local\n> repositories, 2024-04-10) is your brainchild and people seem to be\n> unhappy about having to adjust their settings.  Are there any advice\n> you can offer them?\n\nwhile I am somewhat unhappy about the need to adjust settings this is\nnot really about that.\n\nIt is undesirable to implement breaking changes, especially in point\nrelease. At the same time it's sometimes necessary, and if the change\nis announced, documented, and actually works it can be acceptable.\n\nHere git-daemon requests that repository be added to list of safe\nrepositories to be able to serve it. Clearly this is a security\nrequirement. A user that has write access to a repository can touch the\nexport-ok file, and then the daemon would potentially serve the\nrepository under some circumstances, potentially exposing the system\nadministrator to some other things that the user did to the repository.\n\nAdding the repository to the list of safe repositories is a known\nconcept that was already required for gitweb and for working with the\nrepository locally, and applying it to git-daemon as well is consistent\nalthough it does require configuration changes for some users.\n\nThe real problem here is that adding the repository to the list of safe\nrepositories does not make it possible to serve it by git-daemon.\n\nThanks\n\nMichal\n\n\n> \n> Michal Suchánek <msuchanek@suse.de> writes:\n> \n> > On Mon, Jun 17, 2024 at 11:15:13PM +0200, Michal Suchánek wrote:\n> >> Hello,\n> >> \n> >> On Mon, Jun 17, 2024 at 11:47:20AM -0700, Junio C Hamano wrote:\n> >> > \"David C. Rankin\" <drankinatty@gmail.com> writes:\n> >> > \n> >> > >   Security enhancement in 2.45.1 have broken ability to serve git over\n> >> > >   https and ssh from local git server running Apache. (web server runs\n> >> > >   as http:http on Archlinux)\n> >> > >\n> >> > >   The fix of adding the following to gitconfig (system-wide and\n> >> > >   per-user in ~/.gitconfig) does not solve the problem:\n> >> > >\n> >> > > [safe]\n> >> > > \tdirectory = *\n> >> > \n> >> > It is not clear what you exactly meant \"per-user\" above, so just to\n> >> > make sure.  Is this set in the global configuration file for the\n> >> > httpd (or whoever Apache runs as) user?\n> >> > \n> >> > The purpose of \"dubious ownershop\" thing is to protect the user who\n> >> > runs Git from random repositories' with potentially malicious hooks\n> >> > and configuration files, so the user being protected (in this case,\n> >> > whoever Apache runs as) needs to declare \"I trust these\n> >> > repositories\" in its ~/.gitconfig file.  What individual owners of\n> >> > /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n> >> > matter when deciding if Apache trusts these repositories.\n> >> \n> >> \n> >> looks like the semantic of 'dubious ownershop' changed recently.\n> >> \n> >> Disro backport of fixes for CVE-2024-32002 CVE-2024-32004 CVE-2024-32020\n> >> CVE-2024-32021 CVE-2024-32465 to 2.35.3 broke git-daemon. No amount of\n> >> whitelisting makes the 'fixed' git serve the repository.\n> >\n> > Same regression between 2.45.0 and 2.45.2 which allegedly fixes the\n> > same CVEs.\n> >\n> > Looks like downgrading to gaping hole version is needed to serve repositories\n> > in general.\n> >\n> > Please consider adjusting the fix so that repositories can still be served.\n> >\n> > Thanks\n> >\n> > Michal\n> >\n> > To reproduce:\n> >\n> > cat /usr/local/bin/git-ping\n> > #!/bin/sh -e\n> >\n> > # Try connecting to one or more remote repository URLs\n> >\n> > while true ; do\n> >         git ls-remote -h \"$1\" >/dev/null\n> >         shift\n> >         [ -n \"$1\" ] || break\n> > done\n> >\n> > mkdir -p /srv/git/some\n> > chown hramrach /srv/git/some\n> > su hramrach -c \"git init --bare /srv/git/some/repo.git\"\n> > su hramrach -c \"touch /srv/git/some/repo.git/git-daemon-export-ok\"\n> > version=2.35.3-150300.10.36.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n> > systemctl start git-daemon.service\n> > git ping git://localhost/some/repo.git\n> > <nothing>\n> >\n> > version=2.35.3-150300.10.39.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n> > systemctl restart git-daemon.service\n> > git ping git://localhost/some/repo.git\n> > fatal: Could not read from remote repository.\n> >\n> > Please make sure you have the correct access rights\n> > and the repository exists.\n> >\n> >\n> > systemctl status git-daemon.service\n> > ● git-daemon.service - Git Daemon\n> >      Loaded: loaded (/usr/lib/systemd/system/git-daemon.service; disabled; vendor preset: disabled)\n> >      Active: active (running) since Thu 2024-06-06 08:29:28 CEST; 6min ago\n> >    Main PID: 31742 (git)\n> >       Tasks: 2 (limit: 4915)\n> >      CGroup: /system.slice/git-daemon.service\n> >              ├─ 31742 git daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n> >              └─ 31749 /usr/lib/git/git-daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n> >\n> > Jun 06 08:29:28 localhost.localdomain systemd[1]: Started Git Daemon.\n> > Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: fatal: detected dubious ownership in repository at '/srv/git//some/repo.git'\n> > Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: To add an exception for this directory, call:\n> > Jun 06 08:29:39 localhost.localdomain git-daemon[31756]:         git config --global --add safe.directory /srv/git//some/repo.git\n> >\n> > git config --global --add safe.directory /srv/git//some/repo.git\n> > mv ~/.gitconfig /etc/gitconfig\n> > git ping git://localhost/some/repo.git\n> > fatal: Could not read from remote repository.\n> >\n> > Please make sure you have the correct access rights\n> > and the repository exists.\n> >\n> > git config --global --add safe.directory /srv/git/some/repo.git\n> > mv ~/.gitconfig /etc/gitconfig\n> > git ping git://localhost/some/repo.git\n> > fatal: Could not read from remote repository.\n> >\n> > Please make sure you have the correct access rights\n> > and the repository exists.\n"},{"id":"497691","messageId":"834862fd-b579-438a-b9b3-5246bf27ce8a@gmail.com","threadId":"61639","inReplyTo":"20240625183411.GW19642@kitsune.suse.cz","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Phillip Wood","fromEmail":"phillip.wood123@gmail.com","sentAt":"2024-06-26T13:03:33Z","receivedAt":"2024-06-26T13:03:36Z","isPatch":false,"sender":{"key":"phillip.wood@dunelm.org.uk","avatar":null},"body":"Hi Michal\n\nOn 25/06/2024 19:34, Michal Suchánek wrote:\n>\n> Adding the repository to the list of safe repositories is a known\n> concept that was already required for gitweb and for working with the\n> repository locally, and applying it to git-daemon as well is consistent\n> although it does require configuration changes for some users.\n> \n> The real problem here is that adding the repository to the list of safe\n> repositories does not make it possible to serve it by git-daemon.\n\nThat is indeed unexpected. I set up git-daemon on my laptop this morning \nand in order to get it to work one has to add \".\"  as well as the \nrepository paths one wants to serve to the list of safe directories. \nClearly that is undesirable and does not really feel any safer that \nusing \"safe.directory=*\". What is happening is that git-daemon checks \nthat the repository path is listed as safe and then changes into that \ndirectory and forks\n\n\tgit upload-pack --strict .\n\n\"git upload-pack\" then checks \".\" against the list of safe directories \nwhich fails. It fails because the safe directory check does not do any \nnormalization such as cleaning up \"//\" elements (as seen in your \nexample) or expanding relative paths on $git_dir before checking it \nagainst the list of safe directories.\n\nI think the fix is probably to make the safe directory check use the \nabsolute path of $git_dir. In the mean time there is a workaround if \nyou're happy to add \".\" to the list of safe directories.\n\nBest Wishes\n\nPhillip\n\n\n> Thanks\n> \n> Michal\n> \n> \n>>\n>> Michal Suchánek <msuchanek@suse.de> writes:\n>>\n>>> On Mon, Jun 17, 2024 at 11:15:13PM +0200, Michal Suchánek wrote:\n>>>> Hello,\n>>>>\n>>>> On Mon, Jun 17, 2024 at 11:47:20AM -0700, Junio C Hamano wrote:\n>>>>> \"David C. Rankin\" <drankinatty@gmail.com> writes:\n>>>>>\n>>>>>>    Security enhancement in 2.45.1 have broken ability to serve git over\n>>>>>>    https and ssh from local git server running Apache. (web server runs\n>>>>>>    as http:http on Archlinux)\n>>>>>>\n>>>>>>    The fix of adding the following to gitconfig (system-wide and\n>>>>>>    per-user in ~/.gitconfig) does not solve the problem:\n>>>>>>\n>>>>>> [safe]\n>>>>>> \tdirectory = *\n>>>>>\n>>>>> It is not clear what you exactly meant \"per-user\" above, so just to\n>>>>> make sure.  Is this set in the global configuration file for the\n>>>>> httpd (or whoever Apache runs as) user?\n>>>>>\n>>>>> The purpose of \"dubious ownershop\" thing is to protect the user who\n>>>>> runs Git from random repositories' with potentially malicious hooks\n>>>>> and configuration files, so the user being protected (in this case,\n>>>>> whoever Apache runs as) needs to declare \"I trust these\n>>>>> repositories\" in its ~/.gitconfig file.  What individual owners of\n>>>>> /srv/my-repo.git/ project has in their ~/.gitconfig file does not\n>>>>> matter when deciding if Apache trusts these repositories.\n>>>>\n>>>>\n>>>> looks like the semantic of 'dubious ownershop' changed recently.\n>>>>\n>>>> Disro backport of fixes for CVE-2024-32002 CVE-2024-32004 CVE-2024-32020\n>>>> CVE-2024-32021 CVE-2024-32465 to 2.35.3 broke git-daemon. No amount of\n>>>> whitelisting makes the 'fixed' git serve the repository.\n>>>\n>>> Same regression between 2.45.0 and 2.45.2 which allegedly fixes the\n>>> same CVEs.\n>>>\n>>> Looks like downgrading to gaping hole version is needed to serve repositories\n>>> in general.\n>>>\n>>> Please consider adjusting the fix so that repositories can still be served.\n>>>\n>>> Thanks\n>>>\n>>> Michal\n>>>\n>>> To reproduce:\n>>>\n>>> cat /usr/local/bin/git-ping\n>>> #!/bin/sh -e\n>>>\n>>> # Try connecting to one or more remote repository URLs\n>>>\n>>> while true ; do\n>>>          git ls-remote -h \"$1\" >/dev/null\n>>>          shift\n>>>          [ -n \"$1\" ] || break\n>>> done\n>>>\n>>> mkdir -p /srv/git/some\n>>> chown hramrach /srv/git/some\n>>> su hramrach -c \"git init --bare /srv/git/some/repo.git\"\n>>> su hramrach -c \"touch /srv/git/some/repo.git/git-daemon-export-ok\"\n>>> version=2.35.3-150300.10.36.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n>>> systemctl start git-daemon.service\n>>> git ping git://localhost/some/repo.git\n>>> <nothing>\n>>>\n>>> version=2.35.3-150300.10.39.1 ; zypper in --oldpackage git-core-$version git-daemon-$version\n>>> systemctl restart git-daemon.service\n>>> git ping git://localhost/some/repo.git\n>>> fatal: Could not read from remote repository.\n>>>\n>>> Please make sure you have the correct access rights\n>>> and the repository exists.\n>>>\n>>>\n>>> systemctl status git-daemon.service\n>>> ● git-daemon.service - Git Daemon\n>>>       Loaded: loaded (/usr/lib/systemd/system/git-daemon.service; disabled; vendor preset: disabled)\n>>>       Active: active (running) since Thu 2024-06-06 08:29:28 CEST; 6min ago\n>>>     Main PID: 31742 (git)\n>>>        Tasks: 2 (limit: 4915)\n>>>       CGroup: /system.slice/git-daemon.service\n>>>               ├─ 31742 git daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n>>>               └─ 31749 /usr/lib/git/git-daemon --reuseaddr --base-path=/srv/git/ --user=git-daemon --group=nogroup\n>>>\n>>> Jun 06 08:29:28 localhost.localdomain systemd[1]: Started Git Daemon.\n>>> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: fatal: detected dubious ownership in repository at '/srv/git//some/repo.git'\n>>> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]: To add an exception for this directory, call:\n>>> Jun 06 08:29:39 localhost.localdomain git-daemon[31756]:         git config --global --add safe.directory /srv/git//some/repo.git\n>>>\n>>> git config --global --add safe.directory /srv/git//some/repo.git\n>>> mv ~/.gitconfig /etc/gitconfig\n>>> git ping git://localhost/some/repo.git\n>>> fatal: Could not read from remote repository.\n>>>\n>>> Please make sure you have the correct access rights\n>>> and the repository exists.\n>>>\n>>> git config --global --add safe.directory /srv/git/some/repo.git\n>>> mv ~/.gitconfig /etc/gitconfig\n>>> git ping git://localhost/some/repo.git\n>>> fatal: Could not read from remote repository.\n>>>\n>>> Please make sure you have the correct access rights\n>>> and the repository exists.\n> \n\n"},{"id":"497715","messageId":"xmqq34oz1shc.fsf@gitster.g","threadId":"61639","inReplyTo":"834862fd-b579-438a-b9b3-5246bf27ce8a@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-06-26T18:14:39Z","receivedAt":"2024-06-26T18:14:41Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Phillip Wood <phillip.wood123@gmail.com> writes:\n\n> ... What is happening is that\n> git-daemon checks that the repository path is listed as safe and then\n> changes into that directory and forks\n>\n> \tgit upload-pack --strict .\n>\n> \"git upload-pack\" then checks \".\" against the list of safe directories\n> which fails. It fails because the safe directory check does not do any\n> normalization such as cleaning up \"//\" elements (as seen in your\n> example) or expanding relative paths on $git_dir before checking it\n> against the list of safe directories.\n> ...\n> I think the fix is probably to make the safe directory check use the\n> absolute path of $git_dir. In the mean time there is a workaround if\n> you're happy to add \".\" to the list of safe directories.\n\nIt still is curious why unnormalized \".\" does not pass \"*\" (which is\nnot even a pattern matching, but is a declaration that says \"don't\nbother which path we are talking about\"), though.  As long as the\nvalue of that configuration is found to be '*' literally, safe\ndirectory data is marked as \"is_safe\" (cf. setup.c:safe_directory_cb\nand setup.c:ensure_valid_ownership; notice that data.path is not\neven consulted if the value of the configuration variable is '*').\n\nAnyway, thanks for digging.\n\n"},{"id":"497718","messageId":"aa94be27-60a5-42d9-adcc-f25f9a8d6ae5@gmail.com","threadId":"61639","inReplyTo":"xmqq34oz1shc.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Phillip Wood","fromEmail":"phillip.wood123@gmail.com","sentAt":"2024-06-26T18:35:32Z","receivedAt":"2024-06-26T18:35:34Z","isPatch":false,"sender":{"key":"phillip.wood@dunelm.org.uk","avatar":null},"body":"On 26/06/2024 19:14, Junio C Hamano wrote:\n> Phillip Wood <phillip.wood123@gmail.com> writes:\n> \n>> ... What is happening is that\n>> git-daemon checks that the repository path is listed as safe and then\n>> changes into that directory and forks\n>>\n>> \tgit upload-pack --strict .\n>>\n>> \"git upload-pack\" then checks \".\" against the list of safe directories\n>> which fails. It fails because the safe directory check does not do any\n>> normalization such as cleaning up \"//\" elements (as seen in your\n>> example) or expanding relative paths on $git_dir before checking it\n>> against the list of safe directories.\n>> ...\n>> I think the fix is probably to make the safe directory check use the\n>> absolute path of $git_dir. In the mean time there is a workaround if\n>> you're happy to add \".\" to the list of safe directories.\n> \n> It still is curious why unnormalized \".\" does not pass \"*\"\n\nSorry if I wasn't clear. \".\" is considered safe with \"safe.directory = \n*\" but I was looking at why it was not considered safe when using \nrepository paths in safe.directory.\n\nBest Wishes\n\nPhillip\n\n> (which is\n> not even a pattern matching, but is a declaration that says \"don't\n> bother which path we are talking about\"), though.  As long as the\n> value of that configuration is found to be '*' literally, safe\n> directory data is marked as \"is_safe\" (cf. setup.c:safe_directory_cb\n> and setup.c:ensure_valid_ownership; notice that data.path is not\n> even consulted if the value of the configuration variable is '*').\n> \n> Anyway, thanks for digging.\n> \n"},{"id":"497721","messageId":"xmqq4j9fzge5.fsf@gitster.g","threadId":"61639","inReplyTo":"aa94be27-60a5-42d9-adcc-f25f9a8d6ae5@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-06-26T18:51:46Z","receivedAt":"2024-06-26T18:51:51Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Phillip Wood <phillip.wood123@gmail.com> writes:\n\n> Sorry if I wasn't clear. \".\" is considered safe with \"safe.directory =\n> *\" but I was looking at why it was not considered safe when using\n> repository paths in safe.directory.\n\nAhh, OK.  We tell them /home/wood/repo/git is a good repository to\nvisit, but daemon's call to ensure_valid_ownership() asks \"I am in\nthe '.' directory; does that match /home/wood/repo/git?\"  \n\nThat sucks.  I agree with your idea that we'd need to canonicalize\nboth before comparing.\n\nTHanks.\n"},{"id":"499385","messageId":"202407260038.46Q0ctEV083266@donotpassgo.dyslexicfish.net","threadId":"61639","inReplyTo":"xmqqr0cl6lxl.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Jamie Landeg-Jones","fromEmail":"jamie@catflap.org","sentAt":"2024-07-26T00:38:55Z","receivedAt":"2024-07-26T01:05:45Z","isPatch":false,"sender":{"key":"jamie@catflap.org","avatar":"https://gravatar.com/avatar/1c71d52fee89e5bd83960576d5c828077153fce55b533414ca9067411c9a5f2e?d=mp&s=160"},"body":"Junio C Hamano <gitster@pobox.com> wrote:\n\n> Dscho, the f4aa8c8b (fetch/clone: detect dubious ownership of local\n> repositories, 2024-04-10) is your brainchild and people seem to be\n> unhappy about having to adjust their settings.  Are there any advice\n> you can offer them?\n\nThis thread has gone quiet. Is it going to be fixed? The issue isn't that\nsettings need to be adjusted, it's that it no longer works whatever\nyour settings are.\n\nI had to go back to.2.45.0\n\nCheers\n\n"},{"id":"499391","messageId":"5747ba0d-7268-4538-9705-11650a7d6e35@gmail.com","threadId":"61639","inReplyTo":"202407260038.46Q0ctEV083266@donotpassgo.dyslexicfish.net","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"David C. Rankin","fromEmail":"drankinatty@gmail.com","sentAt":"2024-07-26T05:58:22Z","receivedAt":"2024-07-26T05:58:26Z","isPatch":false,"sender":{"key":"drankinatty@gmail.com","avatar":null},"body":"On 7/25/24 7:38 PM, Jamie Landeg-Jones wrote:\n> Junio C Hamano <gitster@pobox.com> wrote:\n> \n>> Dscho, the f4aa8c8b (fetch/clone: detect dubious ownership of local\n>> repositories, 2024-04-10) is your brainchild and people seem to be\n>> unhappy about having to adjust their settings.  Are there any advice\n>> you can offer them?\n> \n> This thread has gone quiet. Is it going to be fixed? The issue isn't that\n> settings need to be adjusted, it's that it no longer works whatever\n> your settings are.\n> \n> I had to go back to.2.45.0\n> \n> Cheers\n> \n\nI too am stuck. It's a damned if you do, damned if you don't Hobson's choice \nof git repo ownership on the server. All worked fine serving both https and \nssh prior to the change, now it is either one or the other but not both. So \neither your read-only pulls and clones are hosed, or your read/write are.\n\nIf more info is needed, let me know and I'm happy to privide it.\n\n-- \nDavid C. Rankin, J.D.,P.E.\n\n"},{"id":"499495","messageId":"202407280346.46S3khd9005129@donotpassgo.dyslexicfish.net","threadId":"61639","inReplyTo":"5747ba0d-7268-4538-9705-11650a7d6e35@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Jamie Landeg-Jones","fromEmail":"jamie@catflap.org","sentAt":"2024-07-28T03:46:43Z","receivedAt":"2024-07-28T03:46:58Z","isPatch":false,"sender":{"key":"jamie@catflap.org","avatar":"https://gravatar.com/avatar/1c71d52fee89e5bd83960576d5c828077153fce55b533414ca9067411c9a5f2e?d=mp&s=160"},"body":"\"David C. Rankin\" <drankinatty@gmail.com> wrote:\n\n> I too am stuck. It's a damned if you do, damned if you don't Hobson's choice \n> of git repo ownership on the server. All worked fine serving both https and \n> ssh prior to the change, now it is either one or the other but not both. So \n> either your read-only pulls and clones are hosed, or your read/write are.\n\nThanks for the reply. I guess I'm potentially not as stuck as you, because\nI don't require ssh access to the repos - they are just mirrors. I have one\nunix user that updates the repository, and the cgit and git https backends run\nas another suexec user exclusively for that task. However, I'm not going to\ncompromise security by giving the web user effective write-access to the files\nit only needs read access to.\n\n> If more info is needed, let me know and I'm happy to privide it.\n\nIf you have any solution, I'd be grateful to hear. I'm a bit puzzled to\nwhat's going on though.\n\nFrom what I gather, the idea was to stop a client user from unintentionally\nrunning potential hook scripts that could be evil. A similar protection was\nalready present, I note, for other methods (I couldn't run git log and other\ncommands directly on a repo i had unix-level read access to, but were owned\nby another user until I added the safe directory thing in .gitconfig)\n\nClosing this hole to make security more consistent is fair enough... however,\nin the case of git-http-backend the \"safe directory\" method doesn't work at\nall!\n\nIs this an accurate summary of the situation?\n\nAs an aside, do you know why this security mechanism blocks ALL access, and\nnot just the execution of hooks? - my mirrors don't have any hook-scripts,\nand as long as I give them read access at the unix level, why are they still\nblocked from doing things like \"git log\" on a repo without having to first\nmark it as safe?\n\nCheers, Jamie\n\n"},{"id":"499497","messageId":"0ae914c6-70be-44b8-a6b8-53f0b15d5674@gmail.com","threadId":"61639","inReplyTo":"202407280346.46S3khd9005129@donotpassgo.dyslexicfish.net","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"David C. Rankin","fromEmail":"drankinatty@gmail.com","sentAt":"2024-07-28T06:57:18Z","receivedAt":"2024-07-28T06:57:20Z","isPatch":false,"sender":{"key":"drankinatty@gmail.com","avatar":null},"body":"On 7/27/24 10:46 PM, Jamie Landeg-Jones wrote:\n>  From what I gather, the idea was to stop a client user from unintentionally\n> running potential hook scripts that could be evil. A similar protection was\n> already present, I note, for other methods (I couldn't run git log and other\n> commands directly on a repo i had unix-level read access to, but were owned\n> by another user until I added the safe directory thing in .gitconfig)\n> \n> Closing this hole to make security more consistent is fair enough... however,\n> in the case of git-http-backend the \"safe directory\" method doesn't work at\n> all!\n> \n> Is this an accurate summary of the situation?\n\nYes it is.\n\n   Prior to the change, the repositories on my git server were owned by the \nuser with push privileges and all repositories would still be cloned over \nhttps. Now unless the files are owned by http (what the web server runs as on \nArchlinux), https users cannot update their repositories anymore. Changes \npushed to the server by the user with ssh access (and owner of the files) \ncannot be pulled over https.\n\n   On the other side of the issue, if I make the webserver the owner of the \nrepos, the ssh user cannot push or pull.\n\n   Gitweb remains happy no matter the ownership.\n\n   I'm all for more security and welcome it, but you have to provide a way to \nconfigure it so that prior functionality is simply not broken. I'll have to \nsearch and find the little truth-table style of repo user:group ownership and \nthe resulting succeed:fail with push/pull from the server.\n\n   I'd be happy if the docs were just updated with a concise explanation of \nhow to support both ssh and https to the same repo running under Apache -- if \nthat is doable. It must be, github does it. I haven't had the time I'd like to \nto further investigate. Next month looks better.\n\n-- \nDavid C. Rankin, J.D.,P.E.\n\n"},{"id":"499758","messageId":"202408010015.4710FGtf018148@donotpassgo.dyslexicfish.net","threadId":"61639","inReplyTo":"0ae914c6-70be-44b8-a6b8-53f0b15d5674@gmail.com","subject":"[SOLVED] Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Jamie Landeg-Jones","fromEmail":"jamie@catflap.org","sentAt":"2024-08-01T00:15:16Z","receivedAt":"2024-08-01T00:15:43Z","isPatch":false,"sender":{"key":"jamie@catflap.org","avatar":"https://gravatar.com/avatar/1c71d52fee89e5bd83960576d5c828077153fce55b533414ca9067411c9a5f2e?d=mp&s=160"},"body":"\"David C. Rankin\" <drankinatty@gmail.com> wrote:\n\n>    I'd be happy if the docs were just updated with a concise explanation of \n> how to support both ssh and https to the same repo running under Apache -- if \n> that is doable.\n\nHi. I've done some investigating, and have discovered what the problem is (with\nmy setup, at least)\n\nIt only tries to access /etc/gitconfig (or /usr/local/etc/gitconfig) - putting\nthe rules in there allow it to work, but with the caveat mentioned by an\nearlier poster - you need to add a path of \".\" as well as the required\ndirectories. (or enable everything with a path of \"*\")\n\nNow, I don't want to do that globally: \"*\" it's too risky, and I haven't\ndelved deep enough to determine if \".\" is a security risk too.\n\nHowever, there is a better solution:\n\nThe problem is, the environment variable HOME isn't defined when the http\nserver calls cgi-http-backend.\n\nI actually have an intermediate script that is called by httpd, that itself\nexecs git-http-backend, so all I needed to do was add the line\n\nexport HOME=/.../git-web-user/\n\nbefore the exec, and it now works as expected, picking up .gitconfig from the\n.../git-web-user/ directory.\n\nIf you call git-http-backend directly, you may be able to set the environment\nvariable in the httpd config. If not, just create an intermediate script,\nsomething like\n\n#!/bin/sh\nexport HOME=...\nexec <path-to-git-http-backend>\n\n, and change http to call that.\n\nNow, I don't think that if not set, git should determine HOME itself (from\nthe password file etc.), as someone may want that disabled for other reasons,\nHOWEVER, this should really be documented.\n\nSo, in my mind, the fix is to fix the \".\" directory requirement, and document\nthe potential need to set HOME.\n\nLer me know if this works for you!\n\nCheers, Jamie\n\n"},{"id":"499968","messageId":"xmqqa5hud8ms.fsf@gitster.g","threadId":"61639","inReplyTo":"202408010015.4710FGtf018148@donotpassgo.dyslexicfish.net","subject":"Re: [SOLVED] Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-08-02T19:31:23Z","receivedAt":"2024-08-02T19:31:29Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jamie Landeg-Jones <jamie@catflap.org> writes:\n\n> I actually have an intermediate script that is called by httpd, that itself\n> execs git-http-backend, so all I needed to do was add the line\n>\n> export HOME=/.../git-web-user/\n>\n> before the exec, and it now works as expected, picking up .gitconfig from the\n> .../git-web-user/ directory.\n\nGood.\n\n> So, in my mind, the fix is to fix the \".\" directory requirement, and document\n> the potential need to set HOME.\n\nGood, too.\n\nThanks for a success report.\n"},{"id":"501871","messageId":"ZtDbSRU68lgkjPw7@kitenet.net","threadId":"61639","inReplyTo":"834862fd-b579-438a-b9b3-5246bf27ce8a@gmail.com","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Joey Hess","fromEmail":"id@joeyh.name","sentAt":"2024-08-29T20:34:17Z","receivedAt":"2024-08-29T20:41:38Z","isPatch":false,"sender":{"key":"id@joeyh.name","avatar":"https://avatars.githubusercontent.com/u/16392?v=4"},"body":"Phillip Wood wrote:\n> That is indeed unexpected. I set up git-daemon on my laptop this morning and\n> in order to get it to work one has to add \".\"  as well as the repository\n> paths one wants to serve to the list of safe directories. Clearly that is\n> undesirable and does not really feel any safer that using\n> \"safe.directory=*\".\n\nHaving also now run into this new landmine, I don't\nsee how safe.directory adds any security to git-daemon at all.\n\ngit-daemon is already told which directory contains the repositories\nto export, and they have to have git-daemon-export-ok in them as well.\nSo the user has already specified what repositories it is safe for\ngit-daemon to use.\n\n> What is happening is that git-daemon checks that the\n> repository path is listed as safe and then changes into that directory and\n> forks\n> \n> \tgit upload-pack --strict .\n\ngit-daemon might as well run children with safe.directory=* itself.\n\n-- \nsee shy jo\n"},{"id":"503462","messageId":"ZvP1P31xSvKaAhjN@kitsune.suse.cz","threadId":"61639","inReplyTo":"xmqq4j9fzge5.fsf@gitster.g","subject":"Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1","fromName":"Michal Suchánek","fromEmail":"msuchanek@suse.de","sentAt":"2024-09-25T11:34:23Z","receivedAt":"2024-09-25T11:34:25Z","isPatch":false,"sender":{"key":"msuchanek@suse.de","avatar":"https://avatars.githubusercontent.com/u/787652?v=4"},"body":"On Wed, Jun 26, 2024 at 11:51:46AM -0700, Junio C Hamano wrote:\n> Phillip Wood <phillip.wood123@gmail.com> writes:\n> \n> > Sorry if I wasn't clear. \".\" is considered safe with \"safe.directory =\n> > *\" but I was looking at why it was not considered safe when using\n> > repository paths in safe.directory.\n> \n> Ahh, OK.  We tell them /home/wood/repo/git is a good repository to\n> visit, but daemon's call to ensure_valid_ownership() asks \"I am in\n> the '.' directory; does that match /home/wood/repo/git?\"  \n> \n> That sucks.  I agree with your idea that we'd need to canonicalize\n> both before comparing.\n\nAnd it's addressed with 0ed3dde067a5dc5141e3a31d950972f00a08b35d at\nleast since 2.46.1\n\nThanks\n\nMichal\n"}]}